CVE-2026-22712
📋 TL;DR
This CVE describes an improper output encoding vulnerability in MediaWiki's ApprovedRevs extension where magic word replacement in ParserAfterTidy allows input data manipulation. Attackers can potentially inject malicious content that gets improperly rendered. This affects MediaWiki installations using the ApprovedRevs extension versions 1.39 through 1.45.
💻 Affected Systems
- MediaWiki - ApprovedRevs Extension
📦 What is this software?
Approved Revs by Wikiworks
Approved Revs by Wikiworks
Approved Revs by Wikiworks
Approved Revs by Wikiworks
⚠️ Risk & Real-World Impact
Worst Case
An attacker could inject malicious scripts or content that gets executed when viewed by other users, potentially leading to cross-site scripting (XSS) attacks, session hijacking, or content defacement.
Likely Case
Limited content manipulation or injection of benign formatting issues due to the specific nature of magic word replacement in the ApprovedRevs context.
If Mitigated
If proper input validation and output encoding are implemented, the vulnerability would be neutralized with no impact.
🎯 Exploit Status
Exploitation requires understanding of MediaWiki's magic word system and ApprovedRevs functionality.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check latest ApprovedRevs extension version from Wikimedia
Vendor Advisory: https://phabricator.wikimedia.org/T412068
Restart Required: No
Instructions:
1. Update the ApprovedRevs extension to the latest version. 2. Apply the patch from the Wikimedia Gerrit repository. 3. Clear MediaWiki caches if necessary.
🔧 Temporary Workarounds
Disable ApprovedRevs Extension
allTemporarily disable the vulnerable extension until patched
Edit LocalSettings.php and comment out or remove the wfLoadExtension('ApprovedRevs'); line
🧯 If You Can't Patch
- Implement strict input validation for all user-supplied content in MediaWiki
- Enable Content Security Policy (CSP) headers to mitigate potential XSS impact
🔍 How to Verify
Check if Vulnerable:
Check ApprovedRevs extension version in MediaWiki's Special:Version page or extension directoryCheck Version:
Check MediaWiki's Special:Version page or examine the ApprovedRevs extension's version fileVerify Fix Applied:
Verify the ApprovedRevs extension has been updated to a version beyond the affected range📡 Detection & Monitoring
Log Indicators:
- Unusual magic word replacement patterns in MediaWiki logs
- Unexpected content modifications in revision history
Network Indicators:
- Unusual POST requests to revision approval endpoints
SIEM Query:
Search for patterns of magic word manipulation in web application logs